| In contrast to conventional access control methods which use static information system accounts and predefined sets of account privileges, dynamic access control approaches (e.g., service-oriented architectures) rely on run time access control decisions facilitated by dynamic privilege management. While account identities may remain relatively constant over time, account privileges may change more frequently based on ongoing mission/business requirements and operational needs of organizations.
Dynamic privilege management includes immediate revocation of privileges (not requiring users terminate and restart the session to reflect changes in privileges). Dynamic privilege management can also refer to mechanisms that change the privileges of users based on dynamic rules, rather than the editing of specific user profiles. Other mechanisms include making automatic adjustments to privileges if accounts are operating out of normal work times, if information systems are under duress, or in emergency maintenance situations. If the IDPS is not configured to dynamically manage account privileges and associated access authorizations to meet security policies, then unauthorized entities may gain access to the information. |
